PT-2025-19726 · Erpnext · Erpnext

Thvt0Ne · Published 2025-05-05 · Updated 2025-05-05 · CVE-2025-28062

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ERPNEXT versions 14.74.3 through 14.82.1

Description A Cross-Site Request Forgery (CSRF) vulnerability was discovered, allowing an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.

Recommendations For ERPNEXT version 14.74.3, update to a version that includes CSRF protections to prevent unauthorized actions. For ERPNEXT version 14.82.1, update to a version that includes CSRF protections to prevent unauthorized actions. As a temporary workaround, consider implementing additional security measures to mitigate the risk of CSRF attacks until a patch is available.

Exploit

Fix

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-28062

Affected Products

Erpnext

References · 7

• 🔥 https://github.com/Thvt0ne/CVE-2025-28062 · Exploit
• 🔥 https://exploit-db.com/exploits/52283 · Exploit
• https://osv.dev/vulnerability/CVE-2025-28062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28062 · Security Note
• https://github.com/frappe/erpnext · Note
• https://t.me/cvedetector/24475 · Telegram Post
• https://twitter.com/CVEnew/status/1919433891540021714 · Twitter Post